ci(gha): make gha actions pending instead of skipped when waiting for comment

.github/trusted-contribution.yml

@@ -1,3 +1,5 @@
 annotations:
   - type: comment
     text: "/gcbrun"
+  - type: comment
+    text: "/gharun"

.github/workflows/test-runner.yml

@@ -1,8 +1,5 @@
 permissions:
   contents: read
-  pull-requests: read
-  issues: read
-  statuses: write
 
 name: "gha: macOS & Windows"
 
@@ -39,6 +36,12 @@ on: # zizmor: ignore[dangerous-triggers]
 
 jobs:
   pre-flight:
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      statuses: write
+      checks: write
     # Save the `ref` of the pull request, so downstream jobs know what to checkout.
     if: >-
       github.event_name != 'issue_comment' ||
@@ -136,12 +139,23 @@ jobs:
           echo "sha=${sha}" >> "${GITHUB_OUTPUT}"
 
           if [[ "${EVENT_NAME}" == "issue_comment" && "${IS_TRUSTED}" == "true" && -n "${sha}" ]]; then
+            run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
             echo "Setting pending commit status for ${sha}..."
             gh api "repos/${GITHUB_REPOSITORY}/statuses/${sha}" \
               -f state="pending" \
               -f context="gha: macOS & Windows" \
               -f description="macOS and Windows builds in progress via /gharun..." \
-              -f target_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" || true
+              -f target_url="${run_url}" || true
+            while IFS=$'\t' read -r check_name check_id; do
+              [[ -z "${check_id}" ]] && continue
+              echo "Setting check run ${check_name} (${check_id}) to in_progress..."
+              gh api --method PATCH "repos/${GITHUB_REPOSITORY}/check-runs/${check_id}" \
+                -f status="in_progress" \
+                -f details_url="${run_url}" \
+                -f 'output[title]=Summary' \
+                -f 'output[summary]=Build in progress via `/gharun`' || true
+            done < <(gh api --paginate "repos/${GITHUB_REPOSITORY}/commits/${sha}/check-runs" \
+              --jq '.check_runs[] | select(.app.slug == "github-actions" and (.name == "macOS-Bazel" or .name == "Windows-CMake")) | "\(.name)\t\(.id)"' || true)
           fi
 
   # Run other jobs once the `pre-flight` job passes. When the `pre-flight`
@@ -227,22 +241,48 @@ jobs:
     secrets: inherit # zizmor: ignore[secrets-inherit]
 
   report-status:
+    permissions:
+      statuses: write
+      checks: write
     name: Report GHA Status
     needs: [pre-flight, macos-bazel, windows-cmake]
     if: >-
       always() &&
       needs.pre-flight.result == 'success' &&
-      needs.pre-flight.outputs.is-trusted == 'true' &&
       (github.event_name == 'issue_comment' || github.event_name == 'pull_request_target')
     runs-on: ubuntu-latest
     steps:
       - name: Publish commit status
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          IS_TRUSTED: ${{ needs.pre-flight.outputs.is-trusted }}
           PR_SHA: ${{ needs.pre-flight.outputs.checkout-sha }}
           MACOS_BAZEL_RESULT: ${{ needs.macos-bazel.result }}
           WINDOWS_CMAKE_RESULT: ${{ needs.windows-cmake.result }}
         run: |
+          run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+
+          if [[ "${IS_TRUSTED}" != "true" ]]; then
+            echo "Setting pending commit status and action_required check runs on ${PR_SHA}..."
+            gh api "repos/${GITHUB_REPOSITORY}/statuses/${PR_SHA}" \
+              -f state="pending" \
+              -f context="gha: macOS & Windows" \
+              -f description="Needs /gharun comment from a maintainer to run" \
+              -f target_url="${run_url}" || true
+            while IFS=$'\t' read -r check_name check_id; do
+              [[ -z "${check_id}" ]] && continue
+              echo "Setting check run ${check_name} (${check_id}) to action_required..."
+              gh api --method PATCH "repos/${GITHUB_REPOSITORY}/check-runs/${check_id}" \
+                -f status="completed" \
+                -f conclusion="action_required" \
+                -f 'output[title]=Summary' \
+                -f "output[summary]=Needs \`\`\`/gharun(${PR_SHA})\`\`\` to run latest commit" || true
+            done < <(gh api --paginate "repos/${GITHUB_REPOSITORY}/commits/${PR_SHA}/check-runs" \
+              --jq '.check_runs[] | select(.app.slug == "github-actions" and (.name == "macOS-Bazel" or .name == "Windows-CMake")) | "\(.name)\t\(.id)"' || true)
+            exit 0
+          fi
+
           if [[ "${MACOS_BAZEL_RESULT}" == "success" && "${WINDOWS_CMAKE_RESULT}" == "success" ]]; then
             state="success"
             desc="macOS and Windows builds passed"
@@ -261,4 +301,25 @@ jobs:
             -f state="${state}" \
             -f context="gha: macOS & Windows" \
             -f description="${desc}" \
-            -f target_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+            -f target_url="${run_url}"
+
+          if [[ "${EVENT_NAME}" == "issue_comment" ]]; then
+            while IFS=$'\t' read -r check_name check_id; do
+              [[ -z "${check_id}" ]] && continue
+              if [[ "${check_name}" == "macOS-Bazel" ]]; then
+                conclusion="${MACOS_BAZEL_RESULT}"
+              elif [[ "${check_name}" == "Windows-CMake" ]]; then
+                conclusion="${WINDOWS_CMAKE_RESULT}"
+              else
+                continue
+              fi
+              echo "Updating check run ${check_name} (${check_id}) to ${conclusion}..."
+              gh api --method PATCH "repos/${GITHUB_REPOSITORY}/check-runs/${check_id}" \
+                -f status="completed" \
+                -f conclusion="${conclusion}" \
+                -f details_url="${run_url}" \
+                -f 'output[title]=Summary' \
+                -f 'output[summary]=Completed via `/gharun`' || true
+            done < <(gh api --paginate "repos/${GITHUB_REPOSITORY}/commits/${PR_SHA}/check-runs" \
+              --jq '.check_runs[] | select(.app.slug == "github-actions" and (.name == "macOS-Bazel" or .name == "Windows-CMake")) | "\(.name)\t\(.id)"' || true)
+          fi